Hackers Exploit QNAP Devices: Active Exploitation of QNAP VioStor NVR Vulnerability Discovered

The increasing reliance on network-attached storage (NAS) devices has made them an attractive target for hackers. QNAP devices, in particular, have become a favored choice for attackers due to their susceptibility to known vulnerabilities and misconfigurations. In this article, we delve into the latest findings by cybersecurity researchers at Akamai, who have discovered active exploitation of the QNAP VioStor Network Video Recorder (NVR) vulnerability, exposing users to the notorious ‘Mirai’ malware.

Exploitation of QNAP VioStor NVR Vulnerability

During their research, the cybersecurity experts at Akamai uncovered that hackers have been actively taking advantage of the QNAP VioStor NVR vulnerability, which has been assigned the CVE-2023-47565 tracking number. This vulnerability has been marked as a ‘High’ severity flaw, with a CVSS v3 score of 8.0, emphasizing the significant risk it poses to users.

By utilizing an OS command injection technique, authorized attackers exploit this vulnerability by initiating a POST request to the management interface. By leveraging the device’s default credentials, they gain unauthorized access to the system, providing an entry point for malicious activities. This exploitation technique allows the attacker to deploy the notorious ‘Mirai’ malware, further compromising the device and potentially enabling it to become part of a botnet.

Recommendations by QNAP

In response to the active exploitation of the QNAP VioStor NVR vulnerability, QNAP has issued recommendations to mitigate the risk for its users. It is essential for users to upgrade their VioStor firmware, particularly on unsupported devices, to ensure they have the latest security patches. Additionally, changing default passwords offers an additional layer of protection against unauthorized access, thwarting potential hackers.

Discovery of Undisclosed Patched Issue

During the course of the InfectedSlurs campaign, the Akamai researchers discovered an undisclosed patched issue. While details remain undisclosed, this discovery highlights the continuous efforts by hackers to exploit vulnerabilities in QNAP devices, necessitating constant vigilance by both users and manufacturers.

SIRT Identifies QNAP VioStor NVR Devices as Targets

The Security Incident Response Team (SIRT) has identified QNAP VioStor NVR devices as primary targets for exploitation. This underscores the importance of taking immediate action to address the known vulnerabilities and weaknesses in the device’s systems to prevent unauthorized access and subsequent compromise.

Confirmation of Targeted Retired VioStor Versions

Following collaboration with US-CERT and QNAP, it has been confirmed that retired VioStor versions, specifically those of 5.0.0 or earlier, are the primary targets of active exploitation. Attackers exploit a remote code execution vulnerability through a POST request to /cgi-bin/server/server.cgi. It is crucial for users utilizing these retired versions to take immediate action to mitigate the risk and protect their QNAP VioStor NVR devices.

Highlighting the Importance of Secure IoT Practices

The discovery of ongoing exploitation of QNAP devices highlights the significance of implementing secure Internet of Things (IoT) practices. Default credentials and outdated network systems create opportunities for botnet infections and expose users to new vulnerabilities. The need for improved IoT practices is evident in the case of legacy systems, which can become breeding grounds for malicious activities. Utilizing strong, unique passwords and regularly updating firmware can significantly mitigate such risks.

The active exploitation of the QNAP VioStor NVR vulnerability serves as a wake-up call for both QNAP device users and manufacturers. Proactive measures, such as promptly upgrading firmware and changing default passwords, can go a long way in safeguarding against unauthorized access and subsequent compromise. Continuous collaboration between researchers, manufacturers, and cybersecurity organizations is crucial in combating the evolving threats posed by hackers targeting IoT devices. By remaining vigilant and adhering to the best security practices, users can ensure a safer and more secure digital environment.

Explore more

Why is LinkedIn the Go-To for B2B Advertising Success?

In an era where digital advertising is fiercely competitive, LinkedIn emerges as a leading platform for B2B marketing success due to its expansive user base and unparalleled targeting capabilities. With over a billion users, LinkedIn provides marketers with a unique avenue to reach decision-makers and generate high-quality leads. The platform allows for strategic communication with key industry figures, a crucial

Endpoint Threat Protection Market Set for Strong Growth by 2034

As cyber threats proliferate at an unprecedented pace, the Endpoint Threat Protection market emerges as a pivotal component in the global cybersecurity fortress. By the close of 2034, experts forecast a monumental rise in the market’s valuation to approximately US$ 38 billion, up from an estimated US$ 17.42 billion. This analysis illuminates the underlying forces propelling this growth, evaluates economic

How Will ICP’s Solana Integration Transform DeFi and Web3?

The collaboration between the Internet Computer Protocol (ICP) and Solana is poised to redefine the landscape of decentralized finance (DeFi) and Web3. Announced by the DFINITY Foundation, this integration marks a pivotal step in advancing cross-chain interoperability. It follows the footsteps of previous successful integrations with Bitcoin and Ethereum, setting new standards in transactional speed, security, and user experience. Through

Embedded Finance Ecosystem – A Review

In the dynamic landscape of fintech, a remarkable shift is underway. Embedded finance is taking the stage as a transformative force, marking a significant departure from traditional financial paradigms. This evolution allows financial services such as payments, credit, and insurance to seamlessly integrate into non-financial platforms, unlocking new avenues for service delivery and consumer interaction. This review delves into the

Certificial Launches Innovative Vendor Management Program

In an era where real-time data is paramount, Certificial has unveiled its groundbreaking Vendor Management Partner Program. This initiative seeks to transform the cumbersome and often error-prone process of insurance data sharing and verification. As a leader in the Certificate of Insurance (COI) arena, Certificial’s Smart COI Network™ has become a pivotal tool for industries relying on timely insurance verification.